What you need to know today.
Dell CSM and WordPress plugins face critical flaws, alongside RCE vulnerabilities in Xspeeder and Totolink devices.
Dell Container Storage Modules (CSM) versions prior to 1.18.0 are affected by multiple critical vulnerabilities, including a Missing Authentication for Critical Function flaw (CVE-2026-63692), Improper Privilege Management (CVE-2026-67269), and Use of Hard-coded Credentials (CVE-2026-61421). These flaws could allow unauthenticated attackers with remote access to gain full administrative control over Kubernetes nodes. The vulnerabilities were detailed in reports from The Hacker News and Cyber Security News.
A critical remote code execution vulnerability (CVE-2025-54322) has been identified in Xspeeder SXZOS through version 2025-12-26. Attackers can exploit this flaw by sending base64-encoded Python code in the 'chkid' parameter to 'vLogin.py', potentially leading to root-level compromise. The 'title' and 'oIP' parameters are also involved in the exploit.
Multiple critical vulnerabilities have been disclosed in various WordPress plugins, including Doctreat Core (CVE-2026-39773, CVE-2026-39770), Kognetiks Chatbot for WordPress (CVE-2026-32579), Meta Box AIO (CVE-2026-39761), Workreap Core (CVE-2026-39759), Taskbot (CVE-2026-39757, CVE-2026-39753), WP Duplicate (CVE-2026-39755), WooCommerce Designer Pro (CVE-2026-32568), and GDPR Framework By Data443 (CVE-2026-39797). These flaws range from unauthenticated privilege escalation and arbitrary file uploads to PHP object injection and remote code execution, impacting a wide array of WordPress sites.
Totolink devices are facing multiple security risks, with critical vulnerabilities found in the TOTOLINK X6000R (CVE-2026-105484) and Totolink A3002MU (CVE-2026-105285, CVE-2026-105284). The X6000R vulnerability in the UploadFirmwareFile Handler component allows for manipulation of firmware updates. The A3002MU has flaws in its QoS Rule Handler and Authentication Check components, potentially leading to unauthorized access and improper authorization.
Rogue Wave's Perforce P4 Search container images, prior to version 2026.4.2, contain a vulnerability where the service authentication token resets to a default, publicly documented value (CVE-2026-100103). This allows unauthenticated attackers with network access to gain the highest application privileges, potentially leading to significant security breaches.
Ahsay AhsayCBS up to version 10.3.2 has a critical vulnerability (CVE-2026-105134) in its Replication Receiver component. Exploiting this flaw through manipulation of the 'random' argument in the UpdateReceivers.do API could lead to operating system command execution.
Balbooa Forms for Joomla, versions prior to 2.4.3.4, suffer from an unauthenticated Remote Code Execution (RCE) vulnerability via field shortcode injection (CVE-2026-102425). The plugin's feature allowing administrator-defined PHP code to run after form submissions can be exploited to execute arbitrary code.